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Comment on "Quantum key distribution via quantum encryption" [Phys. Rev. A 64, 

024302 (2001)] 

Fei Gao 1 ' 2 '*, Sujuan Qin 1 , Qiaoyan Wen 1 , and Fuchen Zhu 3 
1 School of Science, Beijing University of Posts and Telecommunications, Beijing, 100876, China 
2 State Key Laboratory of Integrated Services Network, Xidian University, Xi'an, 710071, China 
3 National Laboratory for Modern Communications, P.O.Box 810, Chengdu, 610041, China 

(Dated: February 1, 2008) 

In the paper [Zhang, Li and Guo, Phys. Rev. A 64, 024302 (2001)], a quantum key distribution 
protocol based on quantum encryption was proposed, in which the quantum key can be reused. 
However, it is shown that, if Eve employs a special strategy to attack, this protocol becomes insecure 
because of the reused quantum key. That is, Eve can elicit partial information about the key bits 
without being detected. Finally, a possible improvement of the Zhang-Li-Guo protocol is proposed. 

PACS numbers: 03.67.Dd, 03.65.Ud 



In Ref . , Zhang, Li and Guo proposed a quantum key 
distribution protocol based on quantum encryption. This 
protocol employs previously shared EPR pairs as a quan- 
tum key to encode and decode the classical cryptography 
key, and the quantum key is reusable. However, here we 
will show that, this protocol would become insecure if 
the quantum key is reused for more than two times. 

For convenience, except for especial declarations, we 
use the same notations as in Ref.p|. Let us give a 
brief description of the Zhang-Li-Guo protocol firstly 
(see Fig. HJ. At the beginning, Alice and Bob share 
some quantity of EPR pairs serving as the quantum key: 
|$+> = 1/V2(|00) + |11)). To send the key bit (0 or 1) 
to Bob, Alice prepares a carrier particle 7 in the corre- 
sponding state \tp) (|0) or |1)), performs a controlled-NOT 
(CNOT) operation on 7 and thus entangles this qubit to 
the previously shared Bell state. Then she transmits this 
qubit to Bob, from which Bob can obtain the key bit ip 
by performing a CNOT operation and a measurement on 
it. Because every sending qubit is in a completely mixed 
state, Eve can not extract information about the key bit. 
Furthermore, to strengthen the security of this protocol, 
Alice and Bob perform a rotation 
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(1) 



on their respective shared particles before encrypting 
each |i/>). 

It is well known that the shared particles in Bell state 
have strong quantum correlation (i.e., entanglement). It 
is this correlation that makes the quantum encryption 
secure. The author of Ref.Q argues that, because this 
correlation cannot be produced by LQCC and the eaves- 
dropper cannot establish this correlation with the sender, 
the quantum key is reusable. However, they overlooked 
a fact that the sending qubit would bring Eve the chance 
to entangle her ancilla to the shared Bell state, which 
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FIG. 1: The Zhang-Li-Guo protocol. Note that in this 
Comment, for simplicity, the operation R(n/i) ® R(ir/i) or 
i?(7r/4)® 3 is not included in our figures. 



means that the eavesdropper can establish this correla- 
tion with the sender. As a result, this protocol becomes 
insecure when the quantum key is reused. 

Now we come to Eve's eavesdropping strategy. Con- 
sider a certain EPR pair shared by Alice and Bob, which 
will be used to encrypt 71,72,73, ■■■ (the corresponding 
states are IV'i), Ifa), l^), ■■• respectively, where ipi = or 
1). Hereafter we use the term "the i-th round" to denote 
the processing procedures of ji, and Alice and Bob's op- 
eration i?(7r/4)(g)i?(7r/4) is taken as the beginning of each 
round. Furthermore, we use \4>io)A,B,E and \4>h)a,b.e to 
denote the states shared by Alice, Bob and Eve at the 
beginning and the end of the i-th round, respectively. 
In addition, the subscriptions A, B and E represent the 
particles belong to Alice, Bob, and Eve respectively, and 
7 represents the sending particle. Suppose Eve prepares 
|0) as her ancilla, the eavesdropping strategy can be de- 
scribed as follows: 

(i) In the first round, Eve entangles her ancilla into the 
Bell state shared by Alice and Bob. More specifically, 
Eve intercepts the sending qubit and performs a CNOT 
operation on her ancilla, then resends the sending qubit 
to Bob (see Fig- EJ ■ The initial state of Alice, Bob and 
Eve's particles can be represented as 
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FIG. 2: Eve's attack in the first round. 
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FIG. 3: Eve's attack in the second round. 



Then the states at various stages in Fig.|21are as follows: 



follows: 





= -^(|0,0,^,0)4 


|1,1,^1,0»A,B, 7 ,B, 


(3) 




= -^(|0,0,^,0)4 


|1, 1,Vi,0))a,b, 7 ,s, 


(4) 


$2) 


= -L(|o,o,Vi,V»i) 


+ |1,1,V'i,V'i))a,b,7,£;, 


(5) 


*3> 


= -L(|o,o,Vi,V»i) 


+ |1,1,V'i,i/'i))a,b,7,£;, 


(6) 



where the overline expresses bit flip, for example, ip 1 = 
■01 + 1 modulo 2. 

In the last stage, when Bob performs his CNOT opera- 
tion, he disentangles the sending qubit (^i) and correctly 
gets the value of ipi , while the original Bell state has now 
been entangled with the state of Eve in the form of 

\<f>u)A,B,E = -^(|0,0, Vl) + |1, l,^l))A,B,E- (7) 

(ii) In the second round, Eve tries to avoid the detec- 
tion and, at the same time, retain her entanglement with 
Alice and Bob. As was proved in Ref.|l(, Eve can not 
obtain information in this round. However, we will show 
that she can take some measures to avoid the detection. 

Firstly, when Alice and Bob perform the operations 
R(-k/A)®R{-k/&) on their "Bell state", Eve also performs 
R(ir/4) on her ancilla. As a result, the entangled state 
of Alice, Bob and Eve will be converted into 



\c/>2 )a,b,e = R(~)® 3 \4>ii)a,b,e 



= - [10,0, 0)4- (-1)^|0, 1,1) 
+ (-l)^|l,0,l) + |l,l,0)] 



A,B,E> 



(8) 



where the identity R{\ )|t/>) = 1/ V2[|0) + (-1)^|1)] was 
used. 

Afterwards, Eve intercepts the sending qubit, performs 
a CNOT operation on it, and then resends it to Bob (see 
Fig. |2l • The states at various stages in Fig. |3| are as 



|*o) = 2 [|0, 0,^2, 0)4- (-1)*|0, 1,^2,1) 

+ (-1)*|1,0,^,1> + |1,1,^,0>] (9) 



= 2 0°' 0.^2,0)4- (-1)^|0, 1,-02,1) 



+ (- 1)*|1, 0,^ 2 ,1) 4- |1,1,0 2 ,O>] 
l* 2 ) = i[|0, 0,V 2 ,0) + (-1)^|0, 1,^,1) 
+ (-1)^|1,0,V2,1) 4-|l,l,^ 2 ,0)] 



A,B,j,E 



(10) 



A,B,7,E 



,(H) 



1*3) = - [|0, 0, 0) + (-l)' / ' 1 10,1,^2,1) 

+ (-1)^11,0,^2,1) 4- |l,l,V 2 ,0)]^ Bi7)E .(12) 



In the last stage, when Bob performs his CNOT opera- 
tion, he disentangles the sending qubit \1Jj2) and correctly 
gets the value of ip2, while leaving the state 

\Ma,b,b = \ [10,0,0)4- (-1)*|0,1,1) 

+ (-l)^|l,0,l) + |1,1,0)] AB B . (13) 

(iii) In the third round, Eve eavesdrops the key bit. 
Firstly, as in step (ii), Eve also performs R(tt/4) on her 
ancilla when Alice and Bob perform R(ir/A) on their re- 
spective particles. The entangled state will be changed 
into 



R(~)® 3 \<l>2l)A,B,E 

[a(|0,0,0)-|l,l,l)) 



2V2 



-0(10,0,1) -|1, 1,0))' 



A,B.E 



, (14) 



where a = 1 + {-Vf 1 , (3=1- (-1)*. 

Afterwards, Eve intercepts the sending qubit, performs 
a CNOT operation, a measurement and another CNOT 
operation on it, and then resends it to Bob (see Fig. 0}. 
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FIG. 4: Eve's attack in the third round. 
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FIG. 5: Eve's attack in the fourth round. 



The states at various stages in Fig. 0] are as follows: 
1 



\n ) 



2V2 



[a (|0, 0,^3, 0) — |1, 1,V 3 ,1» 



(3 (|0,0,V>3,1> -|1,1,^3,0))' 



A,B,f,E 



, (15) 



2V2 



[a(|0,0,^s,0)-|l,l,V 3 ,l» 



0(10,0,^,1) -ii,i,v 35 o)); 



(16) 



10,) = 



[a(|0, 0,^,0)- |l,l,-03, 1>) 



p (10,0,^3,1) -|M,V> 3) o»] ABi7)B , (17) 



10,) = 



2^ 



[a(|0,0,^3,0>-|l,l,V3,l>) 



j 9(|0,0,Vfs,l> -11,1,^3,0)); 



A,B,-y,E' 



|n 4 > = 



2V2 



[a(|0,0,^,0)-|l,l,^3,l» 



/3 (10,0,^3,1)- 11,1,^3,0))' 



(18) 



(19) 



It can be seen that Eve disentangles the key qubit by 
a CNOT operation, and then restores the entangled state 
by another CNOT operation after a measurement. As 
a result, Eve obtains the measurement result ^3 + ip% 
(modulo 2) and Bob correctly gets the value of tp 3 . At 
last, the entangled state of Alice, Bob and Eve can be 
written as 



1 



D31/A,B,E 



2V2 



[a(|0,0,0)-|M,l» 



-/3(|0,0,1>-|1,1,0»' 



A.B.E' 



(20) 



(iv) In the fourth round, Eve uses a similar strategy 
as in the second round to avoid the detection, the only 
difference is that Eve has to perform an additional X = 

y l' ) °P era ti° n on the sending qubit here (see Fig-EJ - 

After their operation i?(?)® 3 , Alice, Bob and Eve change 



the entangled state into 



\<t>4o)A, 



B.E 



^( I ) 03 |03l)A. 



B,E 



--[|0, 0,1) + (-1)*|0,1,0) 
+ (-l)^|l,0,0) + |l,l,l)] 



A, B.E 



(21) 



Then Eve performs the operations as described in 
Fig. O The states at various stages are as follows: 



|e ) 



I9i) 



= -J [10, 0, V4, l) + (-l)' 01 10,1,^4,0) 

+ (-1)^|1, 0, ^4, 0) + |1, 1, ^4, 1)] a B , E , (22) 



--[|0,0,^4,1) + (-1)^10,1,^4,0) 

(-1)*|1,0,^4,0) + |1, 1,^ 4 ,1)] 



A,B,j,E 



(23) 



ie 2 ) = 



-- [|0,0, 7^4, i) + (-i) v ' 1 |o, 1>4,0) 



+ (-l)^|l,0>4,0> + |1,1,V 4 ,1)] A . B ^ B ,(24) 



A,B,-y,E' 

|e 3 ) = -i [10,0,^4,1) + (-1)^10,1,^4,0) 

+ (-1)^|1, 0, ^4, 0) + |1, 1, ^4, 1)] A>B>liE . (25) 

It can be seen that, in the last stage, Bob correctly 
gets the value of ip4, while leaving the state 

1 



\<ki)A,B,E = --[|o,o,i) + (-1)^10,1,0) 



+ (-l)^|l,0,0) + |1,1,1)] 



A, B.E 



(26) 



(v) In the fifth round, Eve uses the same strategy as 
in the third round to eavesdrop the key bit, that is, the 
strategy in step (iii). After their operation i?^)® 3 , Al- 
ice, Bob and Eve change the entangled state into 



\<P: 



50/ A,B,E 



R(^) m \MA. 



B,E 



2V2 



[a(|0,0,0) + |l,l,l)) 



+/?(|0,0,l) + | 1,1,0))] 



A, B.E' 



(27) 
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Then Eve performs the operations as described in 
Fig. 01 The states at various stages are as follows: 



[To) 



[TO 



1 



2\/2 



[a (|O,O,0 5 ,O) + |1, 1,05,1)) 



+P (|0, 0, 5 , 1) + |1, 1, 05, 0)) ] A Brf E , (28) 
[a (|Q,O,05,O) + |1,1,0 5 ,1)) 



2^/2 



+/3(|O,O,0 5 ,1) + |1,1,0 5 ,O))] AB ^,(29) 



[a (|O,O,0 5 ,O) + |1, 1,05,1)) 



2^2 



+/?(|O,O,0 5 ,1) + |1,1,0 5 ,O))] AB ,(30) 



2^2 



[a(|O,O,0 5 ,O) + |l,l,0 5 ,l)) 



+/? (|O,O,0 5 ,1) + |1,1,^ 5) 0»; 



A,B,i,E 



,(31) 



= [a (|O,O,0 5 ,O) + |1,1,0 5 ,1)) 



2V2 1 

+/? (10,0,-05, 1) + |1, 1,05,0))" 



A,B,~/,E' 



(32) 



where T p corresponds to the state fi p in Fig. 0J (p = 
0, 1, 2, 3, 4). It can be seen that Eve's measurement result 
in this round is 05 + ipi (modulo 2). 

Obviously, in the last stage, Bob correctly gets the 
value of 05, while leaving the state 



\<t>. 



51/ A.B.E 



a(|0,0,0) + |l,l,l)) 



+/3(|0,0,1) + |1,1,0))] 



A,B.E' 



(33) 



Comparing the state \4>5i)a,b,e with \<fiu) a,b,e, we 
can verify that the two states is equivalent except for a 
global phase factor (i.e., —1). That is, from an obser- 
vational point of view these two states are identical . 
Therefore, in the following rounds, Eve can use the same 
strategy as in the steps from (ii) to (v) repeatedly. 

Now let us give a concretely description of our eaves- 
dropping strategy: 

1. In the first round, Eve performs the operations as 
described in Fig. [3 

2. When Alice and Bob perform R(j) on their respec- 
tive particles at the beginning of every round (ex- 
cept for the first round), Eve also performs R(j ) 
on her ancilla; 

3. From the second round to the fifth round, Eve per- 
forms the operations as described in Fig. |3| Fig. 0] 
Fig. Eland Fig. 0] in turn; 

4. In the following rounds, Eve performs the opera- 
tions as described in item 3 repeatedly. 

From the above analysis, we can see that in our eaves- 
dropping strategy no error will be introduced to the key 



distribution between Alice and Bob, and Eve will obtain 
exactly the result of 

03 + 01, 05 + 01, 7 + 01, 09 + 01, • • • 

from which she can infer about half of the key bits by 
checking two possible values for ipi . It should be empha- 
sized that there is another profitable fact for Eve. That 
is, at the end of QKD procedure, Alice and Bob will 
compare a subsequence of the key bits publicly to detect 
eavesdropping, which obviously leak useful information 
to Eve. 

Now it is worthwhile to inspect the basic idea of our at- 
tack strategy. Though Eve cannot get information about 
the key bit in every even rounds (as proved in Ref.|l(), 
she can take some more clever measures to avoid the de- 
tection and retain her entanglement with Alice and Bob 
so that she can eavesdrop the key bit in the next round. 
Our attack strategy is exactly based on this fact. By our 
strategy, if the shared Bell states are reused for many 
times, Eve can obtain about half of the key bits without 
being detected by Alice and Bob. One may argue that 
the shared Bell states would not be reused for too many 
times without special treatments by Alice and Bob, such 
as quantum privacy amplification and entanglement pu- 
rification [l| . However, from above analysis it can be seen 
that Eve needs only three rounds to elicit partial informa- 
tion about the key bits, which definitely forms a serous 
threaten to the Zhang-Li-Guo protocol. In fact, the QKD 
protocols in Refs.0,0 have similar hidden troubles, see 
Refs.HH for details. 

Before we conclude, let us give a discussion about the 
rotation 



R{6) 



cos 6 sin ( 
— sin cos ( 



(34) 



which plays an important role in the Zhang-Li-Guo pro- 
tocol. Without Alice and Bob's rotations at the begin- 
ning of every round, this QKD protocol would be inse- 
cure. For example, in this condition Eve can entangle her 
ancilla into the Bell state in the first round (as described 
in Fig. [21, and then elicit information about the key bits 
in the following rounds (as described in Fig. As a 
result, Eve will obtain the result of 

02 + 01, 03 + 01, 04 + 01, 05 + 01, 

(To avoid confusion we call this attack strategy Si, and 
call the strategy we showed in above paragraphs S2.) 
Therefore, the rotations are necessary, and ir/4 is selected 
as the rotation angle because it leads to the maximum 
error rate (i.e., 1/2) caused by Eve when she uses the 
strategy Si 0. However, it is the selection of 9 = 7r/4 
that makes the Zhang-Li-Guo protocol insecure against 
S2. That is, the error rate caused by Eve is when 
she uses the strategy S2. Hereafter we use d\ and di 
to denote the error rate corresponding to S\ and S2, re- 
spectively. In fact, it is not difficult to prove that, if 
9 =/= ktr ± 7r/4 (fc = 0, ±1, ±2, ...), it is impossible for Eve 



5 



to elicit information about the key bits without introduc- 
ing disturbance (See the Appendix for details). Conse- 
quently, by altering 9, we can modify the Zhang-Li-Guo 
protocol so that it can resist both Si and 52- 

As was given in Ref. lj, when Eve uses Si to at- 
tack, the error rate is di = 2 cos 2 9 sin 2 9. By simi- 
lar deduction we can obtain the error rate when S2 is 
used, i.e., d,2 = ^(sin 2 6> — cos 2 #) 2 . Clearly, there is a 
trade-off between di and d^-, which satisfy the ralation of 
di + d 2 = 1/2. That is, a greater di results in a smaller 
tfc, and vice versa. It can be seen that 9 = ir/4 is a 
extreme instance, where di reaches its maximum value 
1/2 but g?2 = 0. Therefore, we can select such a ro- 
tation angle (denoted as 60) that di = di = 1/4, i.e., 
2 cos 2 6*o sin 2 #0 = 1/4. As a result, when we use 9q in- 
stead of 7r/4 in the Zhang-Li-Guo protocol, it can resist 
both attack strategies (because either strategy will in- 
troduce an error rate of 1/4). We have to confess that 
this modification decreases the efficiency of eavesdrop- 
ping detection. However, 1/4 is still a sufficient value 
for a detection probability. In fact, as far as the gen- 
eral intercept-resend strategy is concerned, the detection 
probability in BB84 protocol 7] is 1/4, too. 

In summary, we have presented a special attack strat- 
egy to the Zhang-Li-Guo protocol Q, in which Eve can 
elicit partial information about the key bits without be- 
ing detected when the quantum key is reused for more 
than two times. Furthermore, we have discussed about 
the ralation between the security and the value of 9, and 
pointed out that this QKD protocol would be secure if 
we use 9q instead of 7r/4. 
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APPENDIX 

In this appendix we will show that when 9 ^ kit ± 7r/4 
(k = 0, ±1, ±2, ...), it is inevitable for Eve to introduce 
disturbance if she has entangled her ancilla into the Bell 
state in the first round. 

Without loss of generality, suppose that in the first 
round Eve's system has entangled with Alice and Bob's 



key in the state 

|A) = -L(|00)|^o> + \11)\<Pi))a,b,e, (A.l) 

where there is no restriction on the form of \ipo) and \<fii). 
After Alice and Bob do a bilateral rotation R(9), Alice 
does a CNOT operation on the sending qubit \ip2) and 
sends it out. Then Eve does a unitary transformation 
on the sending qubit and her own system. She expects 
that Alice and Bob cannot detect her existence (i.e., the 
error rate caused by her is 0). Assume that the unitary 
transformation has the universal form 

U~f, E \i)-y\tPj)E = (aij\0)\ipaij) + bij\l)\ipuj))y,E, (A. 2) 

where i,j = 0, 1 and there is no restriction on the final 
state of \f) e- At last, Bob receives the sending qubit and 
uses a CNOT operation to disentangle it from the shared 
state. 

Suppose that the composite system |A) a,b,e® IV^K is 
changed into |A) after all the above operations, we can 
easily write the form of the state |A). If the attack is 
successful, it requires that the sending qubit \ip2) is cor- 
rectly disentangled by Bob. To satisfy this requirement, 
we obtain the following results: 

When ip 2 — 0, we get 

6 o cos 2 9\<p b0 o) + b i sin 2 6\<p b01 ) = 0, (A. 3) 
-a osm6>cos6>|^ a0 o) + a i sin 6* cos9\ip a0 i) = 0, (A. 4) 
—bio sin 9 cos 9\<fbio) + bn sin 9 cos 9\ifbii) =0, (A. 5) 
aio sin 2 9\ip a w) + an cos 2 9\ip a n) = 0. (A. 6) 

When ip2 = 1, we get 

aio cos 2 6\y aW ) + an sin 2 0\cp a ii) = 0, (A. 7) 
b 00 sin 2 %MX)) + b oi cos 2 9\ip b0 i) = 0, (A. 8) 

where we omit two equations the same as Eas. ljA.4ll and 
(lA~5l . 

With the help of Eas. l|A~l"|) ~ (lA~8)) . we then obtain two 
possible conditions: either (1) \ipo) — \<Pi), which means 
| A) is a product state of Eve's ancilla and Alice and Bob's 
Bell state; or (2) 9 = kir ± 7r/4. This result implies that 
only when 9 — kit ± 7r/4 Eve can entangle her ancilla 
into the Bell state without introducing any disturbance, 
which is the exact conclusion we want to prove. 
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